linux/net
David Ward fb745e9a03 net/802/mrp: fix possible race condition when calling mrp_pdu_queue()
(Adapted from a very similar change to net/802/garp.c by Cong Wang.)

mrp_pdu_queue() should ways be called with the applicant spin lock.
mrp_uninit_applicant() only holds the rtnl lock which is not enough;
a race is possible because mrp_rcv() is called in BH context:

	mrp_rcv()
	  |->mrp_pdu_parse_msg()
	    |->mrp_pdu_parse_vecattr()
	      |->mrp_pdu_parse_vecattr_event()
	        |-> mrp_attr_event()
	          |-> mrp_pdu_append_vecattr_event()
	            |-> mrp_pdu_queue()

Cc: Cong Wang <amwang@redhat.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David Ward <david.ward@ll.mit.edu>
Acked-by: Cong Wang <amwang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2013-04-12 15:10:48 -04:00
..
9p
802 net/802/mrp: fix possible race condition when calling mrp_pdu_queue() 2013-04-12 15:10:48 -04:00
8021q
appletalk
atm atm: update msg_namelen in vcc_recvmsg() 2013-04-07 16:28:00 -04:00
ax25 ax25: fix info leak via msg_name in ax25_recvmsg() 2013-04-07 16:28:00 -04:00
batman-adv
bluetooth Bluetooth: SCO - Fix missing msg_namelen update in sco_sock_recvmsg() 2013-04-07 16:28:01 -04:00
bridge
caif caif: Fix missing msg_namelen update in caif_seqpkt_recvmsg() 2013-04-07 16:28:01 -04:00
can can: gw: use kmem_cache_free() instead of kfree() 2013-04-09 09:58:44 +02:00
ceph
core rtnetlink: Call nlmsg_parse() with correct header length 2013-04-08 17:12:26 -04:00
dcb
dccp
decnet
dns_resolver
dsa
ethernet
ieee802154
ipv4 tcp: Reallocate headroom if it would overflow csum_start 2013-04-11 18:12:41 -04:00
ipv6 ipv6/tcp: Stop processing ICMPv6 redirect messages 2013-04-07 12:36:08 -04:00
ipx
irda irda: Fix missing msg_namelen update in irda_recvmsg_dgram() 2013-04-07 16:28:01 -04:00
iucv af_iucv: fix recvmsg by replacing skb_pull() function 2013-04-08 17:16:57 -04:00
key
l2tp l2tp: fix info leak in l2tp_ip6_recvmsg() 2013-04-07 16:28:01 -04:00
lapb
llc llc: Fix missing msg_namelen update in llc_ui_recvmsg() 2013-04-07 16:28:01 -04:00
mac80211
mac802154
netfilter netfilter: nf_nat: fix race when unloading protocol modules 2013-04-12 11:46:31 +02:00
netlabel
netlink
netrom netrom: fix invalid use of sizeof in nr_recvmsg() 2013-04-08 22:49:23 -04:00
nfc NFC: llcp: fix info leaks via msg_name in llcp_sock_recvmsg() 2013-04-07 16:28:02 -04:00
openvswitch
packet
phonet
rds
rfkill
rose rose: fix info leak via msg_name in rose_recvmsg() 2013-04-07 16:28:02 -04:00
rxrpc
sched cbq: incorrect processing of high limits 2013-04-02 14:29:20 -04:00
sctp
sunrpc NFS client bugfixes for Linux 3.9 2013-04-10 09:00:51 -07:00
tipc tipc: fix info leaks via msg_name in recv_msg/recv_stream 2013-04-07 16:28:02 -04:00
unix af_unix: If we don't care about credentials coallesce all messages 2013-04-05 00:49:13 -04:00
vmw_vsock VSOCK: Fix missing msg_namelen update in vsock_stream_recvmsg() 2013-04-07 16:28:02 -04:00
wimax
wireless Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211 2013-04-03 14:19:48 -04:00
x25
xfrm
compat.c
Kconfig
Makefile
nonet.c
socket.c
sysctl_net.c